An Intelligent Malware Detection and Classification System Using Apps-to-Images Transformations and Convolutional Neural Networks

Naït‐Abdesselam, Farid; Darwaish, Asim; Titouna, Chafiq

doi:10.1109/wimob50308.2020.9253386

Cited by 4 publications

(2 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Naït-Abdesselam et al [20,21] proposed transforming the APK into an RGB leveraging the three channels to store different data on them (Green Channel: Conversion of Permissions and app components from AndroidManifest.xml, Red Channel: Conversion of API calls and unique opcode sequences from DEX file, Blue Channel: Conversion of protected strings, suspected permissions, app components, and API calls) image to use it in a CNN and ResNet for classification of malware. The method was evaluated using the AndroZoo dataset, which increases the number of samples across time.…”

Section: Image Visualizationmentioning

confidence: 99%

Android Malware Classification Based on Fuzzy Hashing Visualization

Rodriguez-Bazan,

Sidorov,

Escamilla-Ambrosio

2023

MAKE

View full text Add to dashboard Cite

The proliferation of Android-based devices has brought about an unprecedented surge in mobile application usage, making the Android ecosystem a prime target for cybercriminals. In this paper, a new method for Android malware classification is proposed. The method implements a convolutional neural network for malware classification using images. The research presents a novel approach to transforming the Android Application Package (APK) into a grayscale image. The image creation utilizes natural language processing techniques for text cleaning, extraction, and fuzzy hashing to represent the decompiled code from the APK in a set of hashes after preprocessing, where the image is composed of n fuzzy hashes that represent an APK. The method was tested on an Android malware dataset with 15,493 samples of five malware types. The proposed method showed an increase in accuracy compared to others in the literature, achieving up to 98.24% in the classification task.

show abstract

Section: Image Visualizationmentioning

confidence: 99%

Android Malware Classification Based on Fuzzy Hashing Visualization

Rodriguez-Bazan,

Sidorov,

Escamilla-Ambrosio

2023

MAKE

View full text Add to dashboard Cite

show abstract

“…Naït-Abdesselam et al [23], [24] proposed transforming the APK into an RGB by leveraging the three channels to store different data on them (Green Channel: Conversion of Permissions and app components from AndroidManifest.xml, Red Channel: Conversion of API calls and unique opcode sequences from DEX file, Blue Channel: Conversion of protected strings, suspected permissions, app components, and API calls) images to use them in a CNN and ResNet for classification of malware. The method was evaluated using the AndroZoo dataset, which increases the number of samples over time.…”

Section: A Image Visualizationmentioning

confidence: 99%

Android Ransomware Analysis Using Convolutional Neural Network and Fuzzy Hashing Features

Rodriguez-Bazan,

Sidorov,

Escamilla-Ambrosio

2023

IEEE Access

View full text Add to dashboard Cite

Most of the time, cybercriminals look for new ways to bypass security controls by improving their attacks. In the 1980s, attackers developed malware to kidnap user data by requesting payment. Malware is called a ransomware. Recently, they have demanded payment in Bitcoin or any other cryptocurrency. Ransomware is one of the most dangerous threats on the Internet, and this type of malware could affect almost all devices. Malware cipher device data, making them inaccessible to users. In this study, a new method for Android ransomware classification was proposed. This method implements a Convolutional Neural Network (CNN) for malware classification using images. This paper presents a novel method for transforming an Android Application Package (APK) into a grayscale image. The image creation relies on using Natural Language Processing (NLP) techniques for text cleaning and Fuzzy Hashing to represent the decompiled code from the APK in a set of hashes after preprocessing using NLP techniques. The image is composed of n fuzzy hashes that represent the APK. This method was tested on a dataset of 7,765 Android ransomware samples obtained from external researchers and public sources. The accuracy of the proposed method was higher than that of other methods in the literature.

show abstract